Skip to content

Commit

Permalink
fix: Remove some utils methods (plain(&), comment(&), unsafe_raw(&) (#69
Browse files Browse the repository at this point in the history
)
  • Loading branch information
stephannv authored Sep 13, 2024
1 parent c0f5405 commit ea82b98
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 55 deletions.
16 changes: 3 additions & 13 deletions spec/blueprint/html/safety_spec.cr
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,7 @@ private class Example
plain "<script>alert('Plain Text')</script>"
render(ExampleComponent.new) { "<script>alert('ExampleComponent')</script>" }
div(class: "some-class\" onblur=\"alert('Attribute')")
comment { "--><script>alert('Plain Text')</script><!--" }
comment "--><script>alert('Another plain text')</script><!--"
comment "--><script>alert('Comment')</script><!--"
v_btn "<script>alert('content')</script>"
v_btn(class: "some-class\" onclick=\"alert('Attribute')") { "<script>alert('hello')</script>" }
end
Expand Down Expand Up @@ -72,19 +71,10 @@ describe "safety" do
page.to_s.should contain(expected_html)
end

it "escapes comment content passed via block" do
it "escapes comment content" do
page = Example.new
expected_html = normalize_html <<-HTML
<!----&gt;&lt;script&gt;alert(&#39;Plain Text&#39;)&lt;/script&gt;&lt;!---->
HTML

page.to_s.should contain(expected_html)
end

it "escapes comment content passed via argument" do
page = Example.new
expected_html = normalize_html <<-HTML
<!----&gt;&lt;script&gt;alert(&#39;Another plain text&#39;)&lt;/script&gt;&lt;!---->
<!----&gt;&lt;script&gt;alert(&#39;Comment&#39;)&lt;/script&gt;&lt;!---->
HTML

page.to_s.should contain(expected_html)
Expand Down
34 changes: 7 additions & 27 deletions spec/blueprint/html/utils_spec.cr
Original file line number Diff line number Diff line change
Expand Up @@ -10,33 +10,25 @@ private class ExamplePage
b "World"
end

span { plain { "Plain!" } }

i "Hi"
whitespace
plain "User"

comment { "This is an html comment" }
comment "This is another html comment"
comment "This is an html comment"

unsafe_raw "<script>Dangerous script</script>"
div { unsafe_raw { "<script>Another dangerous script</script>" } }
div do
unsafe_raw "<script>Dangerous script</script>"
end
end
end

describe "utils" do
describe "#plain" do
it "renders plain text passed via argument" do
it "renders plain text" do
page = ExamplePage.new

page.to_s.should contain("<div>Hello<b>World</b></div>")
end

it "renders plain text passed via block" do
page = ExamplePage.new

page.to_s.should contain("<span>Plain!</span>")
end
end

describe "#doctype" do
Expand All @@ -48,17 +40,11 @@ describe "utils" do
end

describe "#comment" do
it "renders an html comment passed via block" do
it "renders an html comment" do
page = ExamplePage.new

page.to_s.should contain("<!--This is an html comment-->")
end

it "renders an html comment passed via argument" do
page = ExamplePage.new

page.to_s.should contain("<!--This is another html comment-->")
end
end

describe "#whitespace" do
Expand All @@ -70,16 +56,10 @@ describe "utils" do
end

describe "#unsafe_raw" do
it "renders content passed via argument without escaping" do
it "renders content without escaping" do
page = ExamplePage.new

page.to_s.should contain("<script>Dangerous script</script>")
end

it "renders content passed via block without escaping" do
page = ExamplePage.new

page.to_s.should contain("<div><script>Another dangerous script</script></div>")
end
end
end
18 changes: 3 additions & 15 deletions src/blueprint/html/utils.cr
Original file line number Diff line number Diff line change
@@ -1,23 +1,15 @@
module Blueprint::HTML::Utils
private def plain(content : String) : Nil
plain { content }
end

private def plain(&) : Nil
::HTML.escape(yield, @buffer)
::HTML.escape(content, @buffer)
end

private def doctype : Nil
@buffer << "<!DOCTYPE html>"
end

private def comment(content : String) : Nil
comment { content }
end

private def comment(&) : Nil
@buffer << "<!--"
::HTML.escape(yield, @buffer)
::HTML.escape(content, @buffer)
@buffer << "-->"
end

Expand All @@ -26,10 +18,6 @@ module Blueprint::HTML::Utils
end

def unsafe_raw(content : String) : Nil
unsafe_raw { content }
end

def unsafe_raw(&) : Nil
@buffer << yield
@buffer << content
end
end

0 comments on commit ea82b98

Please sign in to comment.